Canvas Companion

Privacy Policy

Last updated: September 6, 2026

Canvas Companion is a Chrome extension that shows your Canvas LMS courses in a side-panel calendar, with local reminders and an optional scoped assistant (“Duey”).

Who we are

Canvas Companion is an independent student project. Source: github.com/Saket0626/canvas-companion

We do not operate a backend that receives your Canvas data. The extension runs in your browser.

Data stored on your device

The extension stores the following in chrome.storage.local on your computer:

• Canvas host you connected (for example elearning.utdallas.edu)
• Cached course names, assignments, quizzes, calendar events, announcements, and stripped plain-text descriptions/syllabus text
• Sync timestamps and reminder state
• Optional Canvas API token, if you paste one in Settings
• Optional LLM provider choice and API key, if you paste one in Settings
• Optional Google OAuth client ID you paste, and a short-lived Google Calendar access token after you sign in
• Optional ICS feed URL, if you paste one for your own notes

This data does not leave your device except as described below.

Data sent over the network

Canvas (required to sync). After you click Connect and approve Chrome’s host-permission prompt, the extension calls your school’s Canvas REST API from the extension service worker using your existing Canvas session cookies. If cookie login fails, it may use a token you saved. Canvas session cookies and tokens are never sent to any other site.

Optional LLM. If you save your own OpenAI or Anthropic key in Settings, Duey and syllabus parse may send a compact summary of cached course/assignment text to that provider. Canvas cookies and tokens are never included. If you do not save a key, calendar, reminders, and most chat answers run locally.

Optional Google Calendar. If you click Sync to Google Cal and complete Google sign-in, the extension sends event titles, times, and descriptions to Google’s Calendar API (www.googleapis.com) using an OAuth access token. Canvas cookies and tokens are never included. You can skip Google Calendar entirely; the local calendar still works.

Optional Rate My Professors. Only if you click to load a public snippet. That request does not attach Canvas cookies.

We do not use analytics, advertising, crash reporters, or other third-party trackers.

What we do not do

• We do not sell or rent your data
• We do not use your data for advertising
• We do not transfer Canvas content to data brokers
• We do not execute remotely hosted extension code

Contact

Open an issue on the GitHub repo.